Reading, migrating,...
 
Notifications
Clear all

Reading, migrating, etc. Microsoft Word 4.0 (for Mac) files

22 Posts
3 Users
0 Likes
2,245 Views
(@gapodaca)
Posts: 14
Active Member
Topic starter
 

Hello,

I'm fairly new to the digital forensics scene, but have been working with FTK 5.6.0 on a FRED with other various software for about a year now in an academic archives setting.

Very briefly, I created several disk images of floppy disks and was able to extract a number of Microsoft Word 4.0 for Mac files. My dilemma is that upon extracting the files, using QuickView Plus, I am able to view content, but lose the formatting.

My question is there a way in which I can access/view a "faithful" version of these files without having to emulate or purchase an older Mac?

I spent some time searching the internet and the closest to an answer I could get was found in this thread from 2008

https://forum.openoffice.org/en/forum/viewtopic.php?f=7&t=74093

I haven't gone the emulation route, as I'm unsure it would work (not to mention I don't have an Apple ROM), and clicking on the "Converting Word for DOS files" found near the bottom of the thread links out to a Patreon account.

Any help would be greatly appreciated!

Thanks

 
Posted : 21/02/2018 8:20 pm
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

I have found Passmark's OSForensics tool to be the most capable forensic tool for viewing email files in general.

OSForensics' Email Module has the ability to display email files in HTML or plain text format.; HTML will display emails with your desired original formatting.

I have also had success viewing and analyzing email files with GetData's Forensic Explorer and Magnet Forensics' Internet Evidence Finder.

For a free options you could try

Autopsy/Sleuthkit https://www.sleuthkit.org/autopsy/download.php

PST Viewer https://www.nucleustechnologies.com/pst-viewer.html

 
Posted : 21/02/2018 11:22 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I have found Passmark's OSForensics tool to be the most capable forensic tool for viewing email files in general.

Is Word (for Mac 4.0) an e-mail program? ? 😯

@gapodaca

It is not that much difficult to procure a Mac ROM image, point is more like whether it is legal to procure and use one, and as well a legal copy of Word for Mac.

The first is up to you to decide, the good news are that PCE-Plus includes both a ROM and a a "configured MAC", including Word (4.0a),
http//www.hampa.ch/pce/pce-macplus.html
http//www.hampa.ch/pub/pce/pce-0.2.2-macplus.zip
released by archive.org (that thus should be fine to use)
https://archive.org/details/mac_MacOS_7.0.1_compilation

jaclaz

 
Posted : 22/02/2018 11:32 am
(@gapodaca)
Posts: 14
Active Member
Topic starter
 

@jaclaz

Pardon my ignorance, but now comes the hard part of trying to open the files I have within the emulator. (I downloaded PCE-Plus.)

Might you have some idea where I can find this documentation? I've tried researching on my own account, but all I've found has not been fruitful.

Many thanks for the initial suggestion.

gapodaca

 
Posted : 22/02/2018 3:42 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

@jaclaz

Pardon my ignorance, but now comes the hard part of trying to open the files I have within the emulator. (I downloaded PCE-Plus.)

Might you have some idea where I can find this documentation? I've tried researching on my own account, but all I've found has not been fruitful.

Many thanks for the initial suggestion.

gapodaca

You need to get HFV explorer (it is as well freeware, though it has no site anymore), find it here
https://www.emaculation.com/doku.php/hfvexplorer

There are a few caveats (the tool is old and is somewhat counterintuitive for someone not having fought already this and many other similar usability battles).

You want to use it to create (File->Format new volume) a new floppy, 1440 Kb, call it "myfloppy" .
Save it as (say) floppy.dsk (the .dsk extension is needed) in the same directory you have pce-plus.
It will appear on the left ABOVE the C\ drive.
Then, from within HFV you navigate to a local folder, let's say C\Wordfiles where you have the Word 4.0 files, select a few ones (less than the 1440 Kb the image allows) and Edit->Copy.
Then navigate back to "myfloppy" and Edit->paste.

Close HFV explorer.

Either rename "floppy.dsk" to "disk2.img" or edit (notepad will do) the pce-mac-plus.cfg (I am assuming you are using pce-mac-plus.batto launch the pce-plus emulator) file, changing the "disk2.img" in it to "floppy.dsk".

Start the pce-plus emulator.
After a small delay you should see the "myfloppy" appear on the desktop.
If you open it you should be able to see the files you copied to it, hopefully with the right "association" with Word.

jaclaz

 
Posted : 22/02/2018 4:11 pm
(@gapodaca)
Posts: 14
Active Member
Topic starter
 

Thank you so very much for your detailed instructions. I was able to create the "myfloppy" HDD and was even successful in copying some files into it.

However, I think I may have messed up on my part when it comes to extracting the files. Using FTK, I'm able to identify the file format of the documents – which is how I *theoretically* know that they are Word 4.0 for Mac. Which leaves me wondering if *something* is going on once I export the files from the disk image (using FTK) and save it on an external HD to then later transfer to my workstation running the emulator (perhaps an association is being created with the version of Word I have installed on my computer – though, it retains the .doc extension…). As a side note, I ran all three emulators that PCE-Plus offers pce-mac-classic.bat, pce-mac-plus.bat, and pce-mac-se.bat, to no avail.

I will investigate further and see if I am somehow *tainting* the integrity of the file either during extraction or transfer, or may try installing the emulator on the FRED. Any insights, as always, would be greatly appreciated.

Again, thank you so much!

 
Posted : 22/02/2018 4:54 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Thank you so very much for your detailed instructions. I was able to create the "myfloppy" HDD and was even successful in copying some files into it.

However, I think I may have messed up on my part when it comes to extracting the files. Using FTK, I'm able to identify the file format of the documents – which is how I *theoretically* know that they are Word 4.0 for Mac. Which leaves me wondering if *something* is going on once I export the files from the disk image (using FTK) and save it on an external HD to then later transfer to my workstation running the emulator (perhaps an association is being created with the version of Word I have installed on my computer – though, it retains the .doc extension…). As a side note, I ran all three emulators that PCE-Plus offers pce-mac-classic.bat, pce-mac-plus.bat, and pce-mac-se.bat, to no avail.

I will investigate further and see if I am somehow *tainting* the integrity of the file either during extraction or transfer, or may try installing the emulator on the FRED. Any insights, as always, would be greatly appreciated.

Again, thank you so much!

You are welcome )

Try doing it the other way around.

I mean, get "out" of the emulator one of the "sample" Word 4.0 files, use HFV explorer to copy it from the floppy to a local hard disk partition, then do to it the same "procedure" you did with FTK and finally try again to insert it to the floppy via HFV explorer.

This way you can maybe understand what happens.

But I am perplexed by your mention of a .doc file extension, a file on Mac has no "extension", it has a MIME type (and in some case a "resource fork", cannot really remember if Word files have it) this is why I hinted about "association" with Word being effective (or not).

At the time, some 25-30 years ago it was a PITA to exchange data between System 7/8 and DOS/Windows, so I am not surprised that some hiccups are happening.

The format should be the same as that of Word 1/2 for Windows
https://en.wikipedia.org/wiki/Microsoft_Word#File_extensions

Maybe the *whatever* parser got the wrong type?

jaclaz

 
Posted : 22/02/2018 5:58 pm
(@gapodaca)
Posts: 14
Active Member
Topic starter
 

Thank you for your speedy reply!

Re your first suggestion about "doing it the other way around"…

The first time I tried this, I copied and pasted one of the resume documents that Word offers into the floppy disk (disk2.img) within the emulator, closed the emulator, opened HFV explorer, but didn't see the volume I had created listed on the left pane. I thought, hmm, maybe don't close the emulator before opening up HFV explorer, but on my second try, that didn't work either. So any clarification/guidance on that topic would be welcome.

The possibility of uploading a single disk image created from one of the floppies I am working with also occurred to me, but upon File->Create new volume, I don't believe HFV explorer opens up .img files. Upon further investigation, I came across a thread that mentioned using EMT4PM Diskette Imager to convert the .img to .dsk, but alas, I received an error message saying that the app could not run on my PC (Win10, x64) which does not come as a real surprise.

So I leave you with two questions, I suppose. As always, any help would be greatly appreciated!

 
Posted : 22/02/2018 7:54 pm
(@gapodaca)
Posts: 14
Active Member
Topic starter
 

Brief update

Was able to get the sample file from the emulator. Just changed the name back from disk2.img to floppy.img!

When I ran it through FTK, the extension was missing, but the program "categorizes" it correctly as a Microsoft Word 4 (Mac) file. When viewing within FTK, the file looks the same as it did within the emulator.

So I guess I'm left wondering if I can upload the disk image and open it within the emulator and see if it opens in there. I have a physical floppy disk drive, if it helps (though I'm sure getting the drive and emulator to communicate is an entirely different can of worms…)

Thanks in advance!

 
Posted : 22/02/2018 8:11 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Open in HFV explorer the floppy where you copied one of the sample files from within the emulator.

Right click on it and choose properties.
Very likely that file has
TypeWDBN
CreatorMSWD

Now click on one of the files you got (already copied to the floppy, NOT on your windows filesystem) let's say the file is called "mytest" and do the same.

Very likely that file has
Type????
CreatorUNIX

Change/edit the Type and Creator to WDBN and MSWD. (the fields are CaSe SeNsItIvE, so those must be ALL CAPITALS)

Close HFV explorer and try starting the emulator.

Now if you double click in the emulator on the "mytest" in the floppy it should open in Word. (and it also should have the Word icon).

jaclaz

 
Posted : 22/02/2018 8:59 pm
Page 1 / 3
Share: